$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret

Infoblox analysis attributes a large transnational cybercriminal enterprise—named Sable Squirrel—with over 10,000 domains and multi-million-dollar dropcatch spending; the actor operates Vietnamese-targeted illegal sports streaming and gambling platforms while concurrently configuring hundreds of the same domains as malware command-and-control, resulting in telemetry linking over 31,000 RAT and other samples (Quasar, AsyncRAT, DCRat, NanoCore, Remcos, njRAT and HiddenTear signatures) to its infrastructure and exposing networks across many industries.